CVE-2025-5003

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in projectworlds Online Time Table Generator 1.0 and classified as critical. This vulnerability affects unknown code of the file /semester_ajax.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
projectworlds	Online Time Table Generator	1.0

References

https://github.com/huangyi234/CVE/issues/4Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.309658Permissions Required, VDB Entry
https://vuldb.com/?id.309658Third Party Advisory, VDB Entry
https://vuldb.com/?submit.580195Exploit, Third Party Advisory, VDB Entry
https://github.com/huangyi234/CVE/issues/4Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: May 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-500306.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Spark Multipurpose spa CVE-2025-500316.5Missing Authorization vulnerability in syedamirhussain91 DB Backup db-backup allows Exploiting Incorrectly Configured Access Control Securit CVE-2025-500326.5Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce paytiko allows Exploiting Incorrectl CVE-2025-500336.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Fitness Park fitness-p CVE-2025-500346.5Missing Authorization vulnerability in Mahmudul Hasan Arif Enhanced Blocks – Page Builder Blocks for Gutenberg enhanced-blocks allows Exploi CVE-2025-500356.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortco CVE-2025-500366.5Cross-Site Request Forgery (CSRF) vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows Cross Site Request Forgery.T CVE-2025-500376.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buying Buddy Buying Buddy IDX CRM buyi CVE-2025-500386.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anantaddons Anant Addons for Elementor CVE-2025-500396.5Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Level CVE-2025-50049.8A vulnerability was found in projectworlds Online Time Table Generator 1.0 and classified as critical. This issue affects some unknown proce CVE-2025-500406.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moshensky CF7 Spreadsheets cf7-spreads